Choose Your Reading Style
A professional-level summary covering key definitions, frameworks, and exam-relevant points.
DMBOK Data Security Knowledge Area
The DAMA DMBOK v2 Data Security knowledge area covers the planning, development, and execution of security policies and procedures to provide proper authentication, authorisation, access, and auditing of data and information assets. It carries approximately 6% of the CDMP exam weight.
Data Classification Levels
| Level | Description | Examples | Controls Required |
|---|---|---|---|
| Public | No harm if disclosed | Marketing materials, published reports | Minimal |
| Internal | Not for external disclosure | Internal memos, operational data | Standard access controls |
| Confidential | Significant harm if disclosed | Customer data, financial records | Encryption, restricted access, audit logging |
| Restricted | Severe harm if disclosed | PII, health data, trade secrets | Maximum controls, strict need-to-know |
Key Security Governance Concepts
Principle of least privilege: Users should have the minimum access rights necessary to perform their job functions. Separation of duties: Critical functions should be divided among multiple people to prevent fraud and errors. Defence in depth: Multiple layers of security controls should be applied, so that if one layer fails, others remain. Data masking and tokenisation: Techniques for protecting sensitive data in non-production environments and analytics use cases.
CDMP Exam Relevance
Data security governance is tested in questions about data classification, access control models (RBAC, ABAC), security policies, and the governance processes for managing access rights. The CDMP exam also tests the distinction between data security (protecting data from unauthorised access) and data privacy (governing how authorised users use personal data).